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IN THE CLAIMS 
Amended claims follow: 

1 . (Previously Presented) A system for analyzing a network, scanning the networic, 
and detecting intrusions in the network, comprising: 

(a) a plurality of agents coupled to apluraEty of computers interconnected via a 
network, each agent adapted to collect information; 

(b) a plurality of host controllers coupled to the ag«its for collecting the infoimation 
from the agents, scajoning the information, and detecting intrusions in the network; and 

(c) a plurality of zone controllers coupled to the host controllers for analyaiag an 
output of the host controllers, and executing security actions in response thereto; 
wherein a report is generated mcluding a plurality of objects in a tree representation; 
wherein intrusion detection services are provided based on the infbnnation; 
wherein a Simple Network Management Protocol (SNMP) trap capability is utilized. 

2. (Original) The system as recited in claim I, wherein the host controllers are 
further capable of cybercop services. 

3. (Original) The system as recited in claim 1, wherein the zone controllo-s are 
further capable of integrated reporting. 

4. (Original) The system as recited in claim 1, wherein the host controUeis and the 
zone controllers operate based on business rules. 

5. (Original) The system as recited in claim 1 , wherein the business rules are user- 
configurable, 

6. (Previously Presented) A method for analyzing a network, scanning the network, 
and detecting intrusions in the network, comprising: 
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(a) collecting infonnation relating to a pte^ity of computers utilizing a plurality of 
agents coupled to the computers via a network; 

(b) collecting the information from the agents utilizing a plurality of host controllers 
coupled to the agents; 

(c) scanning the information utilizing the host controllers; 

(d) detecting intrusions in the network utilizing the host controllers; 

(e) collecting the information from the host controllers utilizing a plur^ty of zone 
controllers coupled to the host controllers; 

{f) analysing output of (b)-(d) utihzing the zone controllers; and 
(g) executing security actions based on flie analysis utilizing the zone controllers; 
wherein a report is generated including a plurality of objects in a tree representation; 
wherein intrusion detection services are provided based on the information; 
wherein a Siniple Network Management Protocol (SNMP) trap capability is utilized. 

7. (Original) The method as recited in claim 6, wherein the host controllers are 
fbrther capable of cybercop services. 

8. (Original) The method as recited in claim 6, wherein the zone controllers are 
fiirther capable of integrated reporting. 

9. (Original) The method as tecited in claim 6, wherein the host controllers and the 
zone controllers operate based on business rules^ 

10. (Original) The method as recited in claim 6, wherein the business rules are user- 
configurable. 

1 1 . (Previously Presented) A computer program product for analyzing a network, 
scanning the network and detecting intrusions in the network, comprising: 

(a) computer code for collecting information relating to a plurality of computers 
utilizing a plurality of agents coupled to the computers via a network; 
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(b) computer code for collecting the information from the agents utilizing a plurality 
of h05t controllers coupled to the agents; 

(c) computer code for scanning the inforaiation utilizing the host controllers; 

(d) computer code for detecting intrusions in the network utilizing the host 
controllers; 

(e) computer code for collecting the infomation from the host coiDttrollers utilizing a 
plurality of zone cootroUers coupled to the host controllers; 

(f) computer code for analyzing output of (b)-(d) utilizing the zone controllers; and 

(g) computer code for executing security actions based on the analysis utilizing the 
zone controllers; 

wherein a report is generated including a plurality of objects in a tree representation; 
wherein intrusion detection services are provided based on the infi>rmation; 
wherein a Simple Network Managem^t Protocol (SNMP) trap capability is utilized. 

12. (Original) The computer program product as recited in claim 1 1, wherein the host 
controllers are lurther capable of cybercop services. 

13. (Original) The computer program product as recited in claim 1 1, wherein the zone 
controllers are iurther capable of integrated reporting, 

14. (Original) The coinputer program product as recited in claim 1 1, wherein the host 
controllers aiid the zone controllers operate based on business rules. 

15. (Original) The computer program product as recited in claim 14, wherem the 
business rules are ua^-configurable. 

16. (Previously Presented) A system for analyzing a network, scanning the network 
and detecting intrusions in the network, comprising: 

(a) agent means adapted to collect information; 

(b) host controller means for collecting the information from the agent means, 
scanning the information, and detecting intrusions in the network; and 
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(c) zone controller means for analyzing an oiitput of the host controller means, and 
executing security actions in response thereto; 

wherein a report is generated including a plurality of objects in a tree representation; 
wherein intrusion detection services are provided based on the information; 
wherein a Simple Network Management Protocol (SNMP) trap capabihty is utilized. 

17- (Original) The system as recited in claim 16, wherein the host controller means is 
further capable of cybercop services. 

18. (Original) The system as recited in claim 16, wherein the zone controller means is 
further capable of integrated reportixig, 

1 9. (Original) The system as recited in claim 16, wherein Ae host controller means 
and the zone controller means operate based on business rules. 

20. (Original) The system as recited in claim 19, wherein the business niles are user- 
conJSgurable. 

21. (Previously Presented) A system for analyzing a network, scanning the network, 
and detecting intrusions in the network, comprising: 

(a) a plurality of agents coupled to a plurality of computers interconnected via a 
network, each agent adapted to collect information; 

(b) a plurality of host controllers coupled to die agents for collecting the information 
from the agents; 

(c) means for scanning the information; 

(d) means for detecting intrusions in the network; 

(e) a phirality of zone controllers coiqjled to the host controllers for analyzing an 
output of the host controllers; and 

(f) means for executing security actions in response to at least one of the scanning, 
the detecting, and the analyzing; 

wherein a report is generated including a plurality of objects in a tree representation; 
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wherein intrusion detection services are provided based on the infoimation; 
wherein a Simple Network Management Protocol (SNMP) trap c^abiKty is utilized. 

22.-28. (Cancelled) 

29. (Previously Presented) The system as recited in claim 1, wherein enteiprise 
latency making is performed. 

30. (Previously Presented) The system as recited in claim 29, wherein at least one of 
the zone contFoUers chooses a port number associated with an application. 

3 1 . (Previously Presented) The system as recited in claim 30, wherein the at least one 
zone controller pushes a configuration requiBst to a plurality of the host controllers in an 
associated zone. 

32. (Previously Presente<0 The system as recited in claim 31, wherein the host 
controllers push the configuration request to the agents. 

33 . (Previously Presented) The system as recited in claim 32, wherein the agents 
monitor a port associated with the port number. 

34. (Previously Presented) The system as recited in claim 33, wherein monitor data is 
sent fi:om tiie agents to the host controllers. 

35. (Previously Presented) The system as recited in claim 34, wherein the monitor 
data is bufiered. 

36. (Previously Presented) The system as recited in claim 34, wherein the host 
controllers update Hie at least one zone controller with consolidated monitor data. 
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37. (Previously Presented) The system as recited in claim 36, wherein differences in 
delay times are calculated to construct a picture of latency throughout an aiterprise. 
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